Google Unveils Cloud Fraud Defense to Extend reCAPTCHA Across Registration, Login and Payments

At Next '26, Google announced Cloud Fraud Defense, a successor to reCAPTCHA that extends bot and fraud detection across account creation, sign-in and payment flows while preserving existing integrations and pricing.

Google introduced Cloud Fraud Defense at Next '26, positioning it as the successor to reCAPTCHA and a broader platform for detecting fraud across registration, login and payment flows. The company says the service uses global threat intelligence and machine learning to evaluate traffic from humans, bots and AI agents, aiming to spot coordinated fraud and stop suspicious activity before it reaches a site. For developers and site owners, that means richer risk signals to automate defenses while keeping verification low-friction for legitimate users.

Existing reCAPTCHA customers are included automatically in Cloud Fraud Defense, Google clarified: no migration is required, no action is needed from customers, and pricing will not change. Lead product manager Jian Zhen told attendees that current site keys and integrations will continue to operate "exactly as they are today," easing the transition for teams already using reCAPTCHA APIs.

Cloud Fraud Defense broadens the approach beyond static CAPTCHA challenges. Google said the service combines its telemetry and models to generate risk scores and reason codes delivered through the existing reCAPTCHA APIs, enabling engineering teams to automate security policies and responses. The company claims the platform can reduce account takeover attempts while verifying the majority of legitimate users in the background, replacing intrusive puzzles with silent, low‑friction verification for most sessions.

The move reflects changes in the threat landscape, where account takeovers and AI-driven identity fraud are rising beyond simple automated bots. A developer identified as Rasu noted that the launch highlights how static CAPTCHAs are becoming inadequate, and community reactions on Reddit echoed concerns about reCAPTCHA v3 and the need for systems that handle both human and agentic traffic.

Google framed reCAPTCHA as "the core bot defense pillar" within Cloud Fraud Defense and kept the same usage — based pricing mechanics: up to 10,000 security assessments per month remain free, with charges applied based on volume thereafter. The company also reiterated an earlier change to reCAPTCHA’s data handling this year, shifting the product from a data controller to a data processor model so deploying organizations assume the role of data controllers.

For builders, the practical implications are immediate: existing integrations keep working, and teams can begin consuming risk scores and reason codes from familiar APIs to automate WAF rules or policy triggers. Google published a Next '26 breakout session titled "Preventing Fraud and Abuse: Securing the New Agent Economy," presented by Jian Zhen; the recording is publicly available for teams seeking implementation guidance and threat — modeling details.